It was discovered that the libuser library contains two vulnerabilities which, in combination, allow unprivileged local users to gain root privileges. libuser is a library that provides read and write access to files like /etc/passwd, which constitute the system user and group database. On Red Hat Enterprise Linux it is a central system component

What is being disclosed today?

Qualys reported two vulnerabilities:

CVE-2015-3245: The userhelper program allows local users to add linefeeds in the middle of records to /etc/passwd, corrupting the file.CVE-2015-3246: libuser uses a non-standard way of updating /etc/passwd and related files. Its locking is incompatible with the rest of the system, and the files are rewritten in place, which means that the system may observe incorrect data.It turns out that the CVE-2015-3246 vulnerability, by itself or in conjunction with CVE-2015-3245, can be exploited by an unprivileged local user to gain root privileges on an affected system. However, due to the way libuser works, only users who have accounts already listed in /etc/passwd can exploit this vulnerability, and the user needs to supply the account password as part of the attack. These requirements mean that exploitation by accounts listed only in LDAP (or some other NSS data source) or by system accounts without a valid password is not possible. Further analysis showed that the first vulnerability, CVE-2015-3245, is also due to a missing check in libuser. Qualys has disclosed full technical details in their security advisory posted to the oss-security mailing list.

Which system components are affected by these vulnerabilities?

libuser is a library, which means that in order to exploit it, a program which employs it must be used. Ideally, such a program has the following properties:

It uses libuser.It is SUID-root.It allows putting almost arbitrary content into /etc/passwd.Without the third item, exploitation may still be possible, but it will be much more difficult. If the program is not SUID-root, a user will not have unlimited attempts to exploit the race condition. A survey of programs processing /etc/passwd and related files presents this picture:

passwd is SUID-root, but it uses PAM to change the password, which has custom code to modify /etc/passwd not affected by the race condition. The account locking functionality in passwd does use libuser, but it is restricted to root.chsh from util-linux is SUID-root and uses libuser to change /etc/passwd (the latter depending on how util-linux was compiled), but it has fairly strict filters controlling what users can put into these files.lpasswd, lchfn, lchsh and related utilities from libuser are not SUID-root.userhelper (in the usermode package) and chfn (in the util-linux package) have all three qualifications: libuser-based, SUID-root, and lack of filters.This is why userhelper and chfn are plausible targets for exploitation, and other programs such as passwd and chsh are not.

How can these vulnerabilities be addressed?

System administrators can apply updates from your operating system vendor. Details of affected Red Hat products and security advisories are available on the knowledge base article on the Red Hat Customer Portal. This security update will change libuser to apply additional checks to the values written to the user and group files (so that injecting newlines is no longer possible), and replaces the locking and file update code to follow the same procedures as the rest of the system. The first change is sufficient to prevent newline injection with userhelper as well, which means that only libuser needs to be updated. If software updates are not available or cannot be applied, it is possible to block access to the vulnerable functionality with a PAM configuration change. System administrators can edit the files /etc/pam.d/chfn and /etc/pam.d/chsh and block access to non-root users by using pam_warn (for logging) and pam_deny:

#%PAM-1.0auth sufficient pam_rootok.soauth required pam_warn.soauth required pam_deny.soauth include system-authaccount include system-authpassword include system-authsession include system-authThis will prevent users from changing their login shells and their GECOS field. userhelper identifies itself to PAM as “chfn”, which means this change is effective for this program as well.

WordPress 4.2.3 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

WordPress versions 4.2.2 and earlier are affected by a cross-site scripting vulnerability, which could allow users with the Contributor or Author role to compromise a site. The new version includes a comprehensive fix for this issue. It also fixed an issue where it was possible for a user with Subscriber permissions to create a draft through Quick Draft.

WordPress 4.2.3 also contains fixes for 20 bugs from 4.2.

Download WordPress 4.2.3 or venture over to Dashboard → Updates and simply click “Update Now”. Sites that support automatic background updates are already beginning to update to WordPress 4.2.3.

For more information, see the release notes or consult the list of changes.

WordPress 4.2.2 is now available. This is a critical security release for all previous versions and we strongly encourage you to update your sites immediately.

Version 4.2.2 addresses two security issues:

The Genericons icon font package, which is used in a number of popular themes and plugins, contained an HTML file vulnerable to a cross-site scripting attack. All affected themes and plugins hosted on WordPress.org (including the Twenty Fifteen default theme) have been updated today by the WordPress security team to address this issue by removing this nonessential file. To help protect other Genericons usage, WordPress 4.2.2 proactively scans the wp-content directory for this HTML file and removes it.

WordPress versions 4.2 and earlier are affected by a critical cross-site scripting vulnerability, which could enable anonymous users to compromise a site. WordPress 4.2.2 includes a comprehensive fix for this issue.

Download WordPress 4.2.2 or venture over to Dashboard → Updates and simply click “Update Now.” Sites that support automatic background updates are already beginning to update to WordPress 4.2.2.

The release also includes hardening for a potential cross-site scripting vulnerability when using the visual editor. WordPress 4.2.2 also contains fixes for 13 bugs from 4.2.

For more information, see the release notes or consult the list of changes.

An update for WordPress was just released to address various security vulnerabilities and we strongly encourgage you to update WordPress to latest version 4.1.2 as soon as possible.

WordPress versions 4.1.1 and earlier are affected by critical cross-site scripting vulnerability, which could enable anonymous users to compromise a site. This has been patched in the latest version, also fixed the following security issues on this update.

1. In WordPress 4.1 and higher, files with invalid or unsafe names could be uploaded.

2. In WordPress 3.9 and higher, a very limited cross-site scripting vulnerability could be used as part of a social engineering attack.

3. Some plugins were vulnerable to an SQL injection vulnerability.

For more details, visit official Link:https://wordpress.org/news/2015/04/wordpress-4-1-2/

An update for WP Super Cache plugin was recently released to address a serious XSS security vulnerability. It is strongly recommended you that update this plugin to the latest version 1.4.4 as soon as possible. Always keep updated all themes/plugins, to avoid intruder access to accounts.